Vijay-Raghav7

**Name of the Vulnerable Software and Affected Versions** NetBox Device Type Library versions prior to commit f41fc1e **Description** The CI workflow `.github/workflows/validation.yml` executes code from pull requests before maintainer review. A contributor can modify the `requirements.txt`, `.pre-commit-hooks-config.yaml`, `.pre-commit-yamlfmt-config.yaml`, or `.gitmodules` files to execute arbitrary code on the CI runner. **Recommendations** Update to the version containing commit f41fc1e.

**Name of the Vulnerable Software and Affected Versions** NetBox Device Type Library (affected versions not specified) **Description** The validation test harness allows the deserialization of tracked pickle cache files via the `pickle.load` method within the `read pickle data()` function located in tests/pickle operations.py. An unauthenticated contributor can modify `USE LOCAL KNOWN SLUGS` in tests/test configuration.py and provide a malicious tests/known-modules.pickle or tests/known-racks.pickle file. When pytest is executed, tests/definitions test.py loads these files, triggering attacker-controlled object reduction behavior. This leads to arbitrary code execution within the GitHub Actions runner or a maintainer's process running the tests, compromising the confidentiality, integrity, and availability of accessible resources. **Recommendations** Apply the fix provided in commit 1c6f7e2b93589b965318c6e67ac3504831f0e71e.

**Name of the Vulnerable Software and Affected Versions** NetBox Device Type Library (affected versions not specified) **Description** An issue exists where the absence of `tests/init.py` and the lack of `--import-mode=importlib` cause pytest to place the tests directory at the front of `sys.path` during collection. This allows an unauthenticated contributor to perform module shadowing by adding a module, such as `tests/git.py`, which shadows GitPython when `tests/definitions test.py` executes `from git import Git, Repo`, or by adding `tests/conftest.py` for automatic execution. Consequently, Python imports and runs the malicious module before any test function, enabling arbitrary code execution on the GitHub Actions runner, tampering with test results, and unauthorized access to tokens or network resources exposed to the workflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetBox Device Type Library (affected versions not specified) **Description** An unauthenticated pull-request author can modify the `NETBOX DT LIBRARY URL` constant in `tests/test configuration.py` before the validation test harness executes. During pytest collection, the `tests/definitions test.py` file passes this value to the `Repo.clone from` and `create remote("upstream").fetch()` functions. This leads to blind Git smart-HTTP requests being sent to a host selected by the attacker or the loading of attacker-controlled `tests/known-*.json` validation caches. While the request cannot set arbitrary metadata-service headers, return response bodies, or execute remote Git hooks, the use of substituted known data can allow the bypass of slug, module, and rack uniqueness validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.